Analysis
-
max time kernel
137s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
29-07-2024 10:41
Static task
static1
Behavioral task
behavioral1
Sample
Wsp1Y2kaMZ5npFn.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Wsp1Y2kaMZ5npFn.exe
Resource
win10v2004-20240709-en
General
-
Target
Wsp1Y2kaMZ5npFn.exe
-
Size
866KB
-
MD5
05e6d0fec133b11165f4db25f7256682
-
SHA1
609af629da07ae0ebbe39c2de2502752f5e4553f
-
SHA256
6030faadae8d2aa1b94b06da9c0d4ed3ce33076a1bc04218027519b1043a6a95
-
SHA512
fd580785c67b8934ea27005c161258dfa8316631b35670a3e208c09464bab34a3b45d246763835dd7b02a9c104c237516e5a3dfb881d465c53e29f4f88c0be18
-
SSDEEP
12288:P+jP6eP9b2N+P7SeThWBfeiRR/Zqa5vQLuB0pnebzv019XdctgSq3X0OywVtBycv:GjP6+3P7SG8Rh51819tN7VtB7
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main payload 1 IoCs
resource yara_rule behavioral2/memory/1080-9-0x0000000000400000-0x0000000000486000-memory.dmp family_masslogger -
Deletes itself 1 IoCs
pid Process 556 powershell.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3528 set thread context of 1080 3528 Wsp1Y2kaMZ5npFn.exe 99 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Wsp1Y2kaMZ5npFn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Wsp1Y2kaMZ5npFn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 3528 Wsp1Y2kaMZ5npFn.exe 3528 Wsp1Y2kaMZ5npFn.exe 3528 Wsp1Y2kaMZ5npFn.exe 3528 Wsp1Y2kaMZ5npFn.exe 3528 Wsp1Y2kaMZ5npFn.exe 3528 Wsp1Y2kaMZ5npFn.exe 3528 Wsp1Y2kaMZ5npFn.exe 1080 Wsp1Y2kaMZ5npFn.exe 1080 Wsp1Y2kaMZ5npFn.exe 556 powershell.exe 556 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3528 Wsp1Y2kaMZ5npFn.exe Token: SeDebugPrivilege 1080 Wsp1Y2kaMZ5npFn.exe Token: SeDebugPrivilege 556 powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 3528 wrote to memory of 2800 3528 Wsp1Y2kaMZ5npFn.exe 97 PID 3528 wrote to memory of 2800 3528 Wsp1Y2kaMZ5npFn.exe 97 PID 3528 wrote to memory of 2800 3528 Wsp1Y2kaMZ5npFn.exe 97 PID 3528 wrote to memory of 1840 3528 Wsp1Y2kaMZ5npFn.exe 98 PID 3528 wrote to memory of 1840 3528 Wsp1Y2kaMZ5npFn.exe 98 PID 3528 wrote to memory of 1840 3528 Wsp1Y2kaMZ5npFn.exe 98 PID 3528 wrote to memory of 1080 3528 Wsp1Y2kaMZ5npFn.exe 99 PID 3528 wrote to memory of 1080 3528 Wsp1Y2kaMZ5npFn.exe 99 PID 3528 wrote to memory of 1080 3528 Wsp1Y2kaMZ5npFn.exe 99 PID 3528 wrote to memory of 1080 3528 Wsp1Y2kaMZ5npFn.exe 99 PID 3528 wrote to memory of 1080 3528 Wsp1Y2kaMZ5npFn.exe 99 PID 3528 wrote to memory of 1080 3528 Wsp1Y2kaMZ5npFn.exe 99 PID 3528 wrote to memory of 1080 3528 Wsp1Y2kaMZ5npFn.exe 99 PID 3528 wrote to memory of 1080 3528 Wsp1Y2kaMZ5npFn.exe 99 PID 1080 wrote to memory of 556 1080 Wsp1Y2kaMZ5npFn.exe 101 PID 1080 wrote to memory of 556 1080 Wsp1Y2kaMZ5npFn.exe 101 PID 1080 wrote to memory of 556 1080 Wsp1Y2kaMZ5npFn.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\Wsp1Y2kaMZ5npFn.exe"C:\Users\Admin\AppData\Local\Temp\Wsp1Y2kaMZ5npFn.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\Wsp1Y2kaMZ5npFn.exe"{path}"2⤵PID:2800
-
-
C:\Users\Admin\AppData\Local\Temp\Wsp1Y2kaMZ5npFn.exe"{path}"2⤵PID:1840
-
-
C:\Users\Admin\AppData\Local\Temp\Wsp1Y2kaMZ5npFn.exe"{path}"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\Wsp1Y2kaMZ5npFn.exe'3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:556
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
412B
MD5e72888b5960716cf170f3e1becd14370
SHA10aeefd2d4a7948a03aad625ca86fc34d79adf248
SHA2568317f594f74040b50e1b88f4aba5e6da3423bf47fe91df59e6e85f37b1f7e0ab
SHA5129cdfda6fc4f324dfd8d53b46610114252431a5d26296a6f3d606b8ffeef172263fbde9ce0a1b2b9232dabcdabd33d6677e9a5f7693b175f24cea622c31b5c6b7
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82